Sub-Processors
Last updated: October 1, 2026
This page identifies services IT Envy Technology Solutions LLC may use to deliver managed IT and managed website services. Which providers apply depends on the services a client uses and the applicable agreement.
We update this page as the service-delivery stack changes. Any contractual notification or objection rights are governed by the applicable client agreement.
Core Managed IT Delivery
| Sub-Processor | Purpose | Data Processed | Data Location |
|---|---|---|---|
| Level | Remote monitoring & management, patch management, script deployment, and remote control of managed devices | Endpoint telemetry, installed software inventory, patch status, remote session metadata | United States |
| Action1 (being retired) | Legacy remote monitoring and patch management on devices not yet moved to Level | Endpoint telemetry, installed software inventory, patch status | United States |
| Blackpoint Cyber | 24/7 managed detection and response | Endpoint security telemetry, alerts, and response actions | United States |
| DNSFilter | DNS security and web filtering | DNS query metadata, device and network identifiers | United States |
| Zoho Assist | On-demand remote support sessions you approve | Session metadata, screen content during an approved session | United States |
| Afi | Microsoft 365 backup | Backed-up mail, OneDrive, SharePoint, and Teams content | United States |
| Evo Security | Helpdesk caller identity verification | User identity, verification events | United States |
| 1Password | Company password manager and credential vault | Credentials (client-side encrypted) | United States |
| EasyDMARC | Email authentication (SPF/DKIM/DMARC) monitoring and enforcement | Email authentication metadata, DNS records | United States |
| Phin Security | Security awareness training and phishing simulations | User email addresses, training completion data | United States |
| Slide.Tech | Business continuity, bare-metal backup, disaster recovery | Server images, file backups | United States |
| ClearlyIP | Cloud VoIP phone service | Call metadata, voicemail | United States |
| Sherweb | Microsoft 365 licensing distribution partner | License assignment metadata | Canada |
| SMTP2GO | Transactional email delivery (notifications, reports) | Outbound email content and metadata | United States |
AI-Assisted Operations
| Sub-Processor | Purpose | Data Processed | Data Location |
|---|---|---|---|
| Anthropic (Claude) | AI-assisted ticket triage, inbox classification, knowledge retrieval, automated remediation proposals | Ticket content, inbox content, device telemetry submitted via API | United States |
Per Anthropic's Commercial Terms, API-submitted data is not used to train foundation models. All AI-proposed remediation actions pass through human-in-the-loop review before being executed on Client systems, except for pre-approved low-risk automated tasks explicitly documented in the applicable Statement of Work.
Client Portal and Managed Websites
| Provider / Service | Purpose | Data Processed | Data Location |
|---|---|---|---|
| Cloudflare | DNS, edge delivery, Workers Static Assets, R2 object storage, security controls, and optional Web Analytics | Request and network metadata, static assets, aggregate traffic and real-user performance measurements; stored objects when R2 is used | Global edge; R2 uses automatic or configured bucket placement. Location hints are best-effort and are not residency guarantees; jurisdictional restrictions apply only when explicitly configured. |
| Railway | Hosting for our client portal and platform application | Application request and runtime metadata, deployment configuration, and operational logs | Provider-managed infrastructure in the configured Railway deployment region |
| PostHog | Cookieless website page and allowlisted conversion-event analytics | Sanitized route, coarse referral/campaign category, device/network metadata, and categorical conversion properties | United States |
| Clerk | Client portal and website authentication and session management | Account identifiers, authentication factors and events, and session metadata | Provider-managed infrastructure according to the configured Clerk instance |
| Convex | Client portal and website application database, authorization, and workflow state | Account, company, site, configuration, workflow, analytics-summary, and audit metadata | Provider-managed infrastructure in the configured deployment region |
| Google Search Console | Site ownership verification and search-performance reporting when connected | Verified site properties, search queries, pages, countries, devices, clicks, and impressions | Google-managed infrastructure |
| Better Stack | Uptime and SSL monitoring for managed websites | Public page availability and certificate status | Provider-managed infrastructure |
Legacy Infrastructure Being Retired
The following self-hosted services still support some internal and legacy workloads while they are moved to the providers above. They are not a statement that every client workload uses them.
| Service | Purpose | Data Location |
|---|---|---|
| Hetzner Online | Underlying server hosting for selected IT Envy-operated and legacy workloads | United States (Ashburn, VA) |
| Coolify | Container orchestration | Self-hosted (Hetzner US) |
| Postgres | Database for selected legacy and internal service workloads | Self-hosted (Hetzner US) |
| Inngest | Legacy background job and workflow orchestration where still active | Self-hosted (Hetzner US) |
| Langfuse | AI request/response observability | Self-hosted (Hetzner US) |
| CIPP | Microsoft 365 tenant management tooling | Self-hosted (Hetzner US) |
| Uptime Kuma | Infrastructure uptime monitoring | Self-hosted (Hetzner US) |
Change Notification
We maintain this page as a current public summary. Notices for material provider changes, when required, follow the applicable client agreement.
Contact: ethan@itenvy.com